xhttp upstream and downstream separation #6042

Master-bit715 · 2026-04-30T10:17:52Z

Master-bit715
Apr 30, 2026

Good afternoon !
Help me configure "xhttp" correctly with upstream and downstream separation of streams.
I used these recommendations (#4113 , #4080).
I don't understand something in Xray-Core. I have two VPS servers with IPv4 and IPv6 addresses on each.
Below is a part of the Xray configuration on the client.
I don't see connections (netstat -anp | grep 443 on client ) on the second downstream stream.
There are no packets (tcpdump -i ens3 ip6 and host 2a00::**:4:2::4fc9) on the server.
There are no attempts to establish a connection with the address 2a14::****::b79 in the "error.log" on the client.
The connection between the two servers is working, but all data is being transferred through upstream.
Please help me start the second thread. Thank you!

Xray 26.3.27 (Xray, Penetrates Everything.) d2758a0 (go1.26.1 linux/amd64)

Xray-Core client configuration

######### Start #########

{

   "log": {
     "access": "/var/log/xray/access.log",
     "error": "/var/log/xray/error.log",
#     "loglevel": "debug",
     "loglevel": "info",
     "dnsLog": true,
     "maskAddress": ""
    },

##########################  INBOUNDS  #############################




    "inbounds": [

    {
      "tag": "tls_in",
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",

      "settings": {




        "clients": [
          {
            "id": "test-tls-id", // Fill in your UUID
            "flow": "xtls-rprx-vision",
            "level": 0,
            "email": "test-tls-id@test.com"
          }
        ],


        "decryption": "none",
        "fallbacks": [
          {
            "dest": 80 // Default fallback to the probe-resistant proxy
          }
        ]
      },

      "streamSettings": {
        "network": "tcp",
        "security": "tls",

        "tlsSettings": {
            "serverName": "194-**-**-82.cloudvps.regruhosting.ru",
            "alpn": "http/1.1",
            "certificates": [
                {
                    "certificateFile": "/usr/local/etc/xray/xray.crt",
                    "keyFile": "/usr/local/etc/xray/xray.key"
                }
            ]
        }


    }

    }



],

################################  ROUTING   ############################################






    "routing": {

        "domainStrategy": "IPIfNonMatch",

        "rules": [
            {
                "type": "field",
                "ip": [  "geoip:ru"  ],
                "outboundTag": "block"
            }
        ]







    },

###################  OUTBOUND #################################################################






    "outbounds": [



        {
            "protocol": "vless",

                    "settings": {


                        "vnext": [
                        {
                        "address": "2.**.**.73",
                        "port": 443,
                        "users": [
                            {
                                "id": "test-x-id",
                                "encryption": "none"
                                }
                        ]
                }
                ]


            },



            "streamSettings": {
                "network": "xhttp",


                "xhttpSettings": {
                    "host": "www.microsoft.com",
                    "path": "/download/updates",
                    "mode": "stream-up",

                    "extra": {
                        "headers": {
                        // "key": "value"
                        },

                    "xPaddingBytes": "100-1000",

                     "xmux": {
                        "maxConcurrency": 128,
                        "hMaxRequestTimes": 1000,
                        "hMaxReusableSecs": 3600
                    }

                    }, //Extra

################################################   Dowanload @@@@@@@

        "downloadSettings": { // только для клиента


            "address": "2a14:****:****::b79"  , // другой домен/IP
            "port": 443,

            "users": [
                        {
                        "id": "test-x1-id",
                        "encryption": "none"
                        }
            ],


            "network": "xhttp",

                "xhttpSettings": {
#                   "host": "speed.cloudflare.com",
                    "path": "/download/updates",
                    "mode": "stream-down",


                    "extra": {
                        "headers": {
                        // "key": "value"
                        },

                        "xPaddingBytes": "100-1000",

                        "xmux": {
                            "maxConcurrency": 128,
                            "hMaxRequestTimes": 1000,
                            "hMaxReusableSecs": 3600
                        }

                    } //Extra


                },   //  xhttpSettings  Dowanload




                "security": "reality",

                    "realitySettings": {
                        "fingerprint": "chrome",
                        "serverName": "speed.cloudflare.com", // A website that support TLS1.3 and h2. If your dest is `1.1.1.1:443`, then leave it empty
                        "publicKey": "Rf-w9MfmJ3uLVnqhFqZJ3veJOpAyv62oOpAyv62o", // run `xray x25519` to generate. Public and private keys need to be corresponding.
                        "spiderX": "", // If your dest is `1.1.1.1:443`, then you can fill it with `/dns-query/` or just leave it empty
                        "shortId": "0123456789abcdef", // Required
                        "alpn": ["h3" ]
                    }
            }    //  downloadSettings


##########################################  END Dowanload







                },  //xhttpSettings  end



                "security": "reality",

                "realitySettings": {
                    "fingerprint": "chrome",
                    "serverName": "www.microsoft.com", // A website that support TLS1.3 and h2. If your dest is `1.1.1.1:443`, then leave it empty
                    "publicKey": "Rf-w9MfmJ3uLVnqhFqZJ3veJOpAyv62oOpAyv62o", // run `xray x25519` to generate. Public and private keys need to be corresponding.
                    "spiderX": "", // If your dest is `1.1.1.1:443`, then you can fill it with `/dns-query/` or just leave it empty
                    "shortId": "0123456789abcdef", // Required
                    "alpn": ["h3" ]
                }
            },  //   Stream Settings











            "tag": "xhttp_out_nl"
        },







        {
            "protocol": "freedom",
            "tag": "direct"
        },

        {
            "protocol": "blackhole",
            "tag": "block"
        }


    ]

} //Global End

Answered by jefcolbi

May 1, 2026

So i cleaned your json a bit

{
  "protocol": "vless",
  "settings": {
    "vnext": [
      {
        "address": "2.**.**.73",
        "port": 443,
        "users": [
          {
            "id": "test-x-id",
            "encryption": "none"
          }
        ]
      }
    ]
  },
  "streamSettings": {
    "network": "xhttp",
    "security": "reality",
    "realitySettings": {
      "fingerprint": "chrome",
      "serverName": "www.microsoft.com",
      "publicKey": "Rf-w9MfmJ3uLVnqhFqZJ3veJOpAyv62oOpAyv62o",
      "spiderX": "",
      "shortId": "0123456789abcdef",
      "alpn": ["h3"]
    },
    "xhttpSettings": {
      "host": "www.microsoft.com",
      "path": "/download/updates",
  …

View full answer

jefcolbi · 2026-05-01T00:35:47Z

jefcolbi
May 1, 2026

So i cleaned your json a bit

{
  "protocol": "vless",
  "settings": {
    "vnext": [
      {
        "address": "2.**.**.73",
        "port": 443,
        "users": [
          {
            "id": "test-x-id",
            "encryption": "none"
          }
        ]
      }
    ]
  },
  "streamSettings": {
    "network": "xhttp",
    "security": "reality",
    "realitySettings": {
      "fingerprint": "chrome",
      "serverName": "www.microsoft.com",
      "publicKey": "Rf-w9MfmJ3uLVnqhFqZJ3veJOpAyv62oOpAyv62o",
      "spiderX": "",
      "shortId": "0123456789abcdef",
      "alpn": ["h3"]
    },
    "xhttpSettings": {
      "host": "www.microsoft.com",
      "path": "/download/updates",
      "mode": "stream-up",
      "extra": {
        "headers": {},
        "xPaddingBytes": "100-1000",
        "xmux": {
          "maxConcurrency": 128,
          "hMaxRequestTimes": 1000,
          "hMaxReusableSecs": 3600
        }
      }
    }
  },
  "downloadSettings": {
    "address": "2a14:****:****::b79",
    "port": 443,
    "users": [
      {
        "id": "test-x1-id",
        "encryption": "none"
      }
    ],
    "network": "xhttp",
    "security": "reality",
    "realitySettings": {
      "fingerprint": "chrome",
      "serverName": "speed.cloudflare.com",
      "publicKey": "Rf-w9MfmJ3uLVnqhFqZJ3veJOpAyv62oOpAyv62o",
      "spiderX": "",
      "shortId": "0123456789abcdef",
      "alpn": ["h3"]
    },
    "xhttpSettings": {
      "host": "speed.cloudflare.com",
      "path": "/download/updates",
      "mode": "stream-down",
      "extra": {
        "headers": {},
        "xPaddingBytes": "100-1000",
        "xmux": {
          "maxConcurrency": 128,
          "hMaxRequestTimes": 1000,
          "hMaxReusableSecs": 3600
        }
      }
    }
  },
  "tag": "xhttp_out_nl"
}

Here is a fixed config

{
  "protocol": "vless",
  "settings": {
    "vnext": [
      {
        "address": "2.**.**.73",
        "port": 443,
        "users": [
          {
            "id": "test-x-id",
            "encryption": "none"
          }
        ]
      }
    ]
  },
  "streamSettings": {
    "network": "xhttp",
    "security": "reality",
    "realitySettings": {
      "fingerprint": "chrome",
      "serverName": "www.microsoft.com",
      "publicKey": "Rf-w9MfmJ3uLVnqhFqZJ3veJOpAyv62oOpAyv62o",
      "spiderX": "",
      "shortId": "0123456789abcdef",
      "alpn": ["h3"]
    },
    "xhttpSettings": {
      "host": "www.microsoft.com",
      "path": "/download/updates",
      "mode": "stream-up",
      "extra": {
        "headers": {},
        "xPaddingBytes": "100-1000",
        "xmux": {
          "maxConcurrency": 128,
          "hMaxRequestTimes": 1000,
          "hMaxReusableSecs": 3600
        },
        "downloadSettings": {
          "address": "2a14:****:****::b79",
          "port": 443,
          "network": "xhttp",
          "security": "reality",
          "realitySettings": {
            "fingerprint": "chrome",
            "serverName": "speed.cloudflare.com",
            "publicKey": "Rf-w9MfmJ3uLVnqhFqZJ3veJOpAyv62oOpAyv62o",
            "spiderX": "",
            "shortId": "0123456789abcdef",
            "alpn": ["h3"]
          },
          "xhttpSettings": {
            "host": "speed.cloudflare.com",
            "path": "/download/updates",
            "mode": "stream-down",
            "extra": {
              "headers": {},
              "xPaddingBytes": "100-1000",
              "xmux": {
                "maxConcurrency": 128,
                "hMaxRequestTimes": 1000,
                "hMaxReusableSecs": 3600
              }
            }
          }
        }
      }
    }
  },
  "tag": "xhttp_out_nl"
}

The downloadSettings is not a top level config like you think, it goes under xhttpSettings -> extra

3 replies

Master-bit715 May 6, 2026
Author

Hello!
I've adjusted the configuration according to the recommendations.
I still don't see any attempts to establish an IPv6 connection. (tcpdump -i ens3 ip6 and host 2a00:f940:2:4:2::4fc9)
And I don't see any connection attempts in the client logs either.

Maybe something else needs to be done on the server? I have separate settings for IPv4 and IPv6 addresses.

New xhttp upstream and downstream separation config

    "outbounds": [



        {
            "protocol": "vless",

                    "settings": {


                        "vnext": [
                        {
                        "address": "2.26.***.73",
                        "port": 443,
                        "users": [
                            {
                                "id": "test-x-id",
                                "encryption": "none"
                                }
                            ]
                        }
                    ]
            },



            "streamSettings": {
                "network": "xhttp",

                "security": "reality",

                "realitySettings": {
                    "fingerprint": "chrome",
                    "serverName": "www.microsoft.com", // A website that support TLS1.3 and h2. If your dest is `1.1.1.1:443`, then leave it empty
                    "publicKey": "Rf-******", // run `xray x25519` to generate. Public and private keys need to be corresponding.
                    "spiderX": "", // If your dest is `1.1.1.1:443`, then you can fill it with `/dns-query/` or just leave it empty
                    "shortId": "0123456789abcdef", // Required
                    "alpn": ["h2"]
                },


                "xhttpSettings": {
                    "host": "www.microsoft.com",
                    "path": "/download/updates",
                    "mode": "stream-up",

                    "extra": {
                        "headers": {
                        // "key": "value"
                        },

                    "xPaddingBytes": "100-1000",

                     "xmux": {
                        "maxConcurrency": 128,
                        "hMaxRequestTimes": 1000,
                        "hMaxReusableSecs": 3600
                    }

                    }


                }   // End Xhttp-UP   Set



            },  // End Stream-Settings UP





        "downloadSettings": { // только для клиента


            "address": "2a14:1b84:****::b79"  , // другой домен/IP
            "port": 443,
            "network": "xhttp",
            "security": "reality",

                "realitySettings": {
                    "fingerprint": "chrome",
                    "serverName": "speed.cloudflare.com", // A website that support TLS1.3 and h2. If your dest is `1.1.1.1:443`, then leave it empty
                    "publicKey": "Rf-******", // run `xray x25519` to generate. Public and private keys need to be corresponding.
                    "spiderX": "", // If your dest is `1.1.1.1:443`, then you can fill it with `/dns-query/` or just leave it empty
                    "shortId": "0123456789abcdef", // Required
                    "alpn": ["h2"]
                },




            "xhttpSettings": {
#                   "host": "speed.cloudflare.com",
                    "path": "/download/updates",
                    "mode": "stream-down",


                    "extra": {
                        "headers": {
                        // "key": "value"
                        },

                    "xPaddingBytes": "100-1000",

                     "xmux": {
                        "maxConcurrency": 128,
                        "hMaxRequestTimes": 1000,
                        "hMaxReusableSecs": 3600
                    }

                }



              }    //Xhttp DOWN Set


            },    //End Dowanload SET


            "tag": "xray_nl"
        },

jefcolbi May 6, 2026

Again downloadSettings must be below xmux so under "xhttpSettings"->"extra" key.
It will work only if you put it there. and change the client config with correct logging for debugging

"log": {
    "loglevel": "debug",
    "access": "",
    "error": "",
    "dnsLog": true
  }

and paste what xray is doing when you attempt to browser. use curl with proxy set to xray inbound proxy port. xray will tell you where it send data and where it will receive them. Then paste here

Master-bit715 May 6, 2026
Author

It worked!
Now there are packets going to the server!
2026/05/06 21:42:06.128887 [Info] [4009872189] app/dispatcher: default route for tcp:api-dbh1-alitools.com:443
2026/05/06 21:42:06.128896 [Info] [4009872189] transport/internet/splithttp: XHTTP is dialing to tcp:2.26.138.73:443, mode stream-up, HTTP version 2, host www.microsoft.com
2026/05/06 21:42:06.128903 [Info] [4009872189] transport/internet/splithttp: XHTTP is downloading from tcp:[2a14:1b84:1000::b79]:443, mode stream-down, HTTP version 2, host speed.cloudflare.com
2026/05/06 21:42:06.128912 [Info] [1591193451] app/dispatcher: default route for tcp:api-dbh1-alitools.com:443
2026/05/06 21:42:06.128965 [Info] [1591193451] transport/internet/splithttp: XHTTP is dialing to tcp:2.26.138.73:443, mode stream-up, HTTP version 2, host www.microsoft.com
2026/05/06 21:42:06.128974 [Info] [1591193451] transport/internet/splithttp: XHTTP is downloading from tcp:[2a14:1b84:1000::b79]:443, mode stream-down, HTTP version 2, host speed.cloudflare.com
2026/05/06 21:42:06.128982 [Info] [4009872189] proxy/vless/outbound: tunneling request to tcp:api-dbh1-alitools.com:443 via 2.26.138.73:443
2026/05/06 21:42:06.128991 [Info] [1591193451] proxy/vless/outbound: tunneling request to tcp:api-dbh1-alitools.com:443 via 2.26.138.73:443
2026/05/06 21:42:06.129001 [Debug] [4009872189] proxy: Xtls Unpadding new block, content 1783 padding 0 command 0
2026/05/06 21:42:06.129010 [Debug] [4009872189] proxy: XtlsFilterTls found tls client hello! 1103
2026/05/06 21:42:06.129021 [Debug] [1591193451] proxy: Xtls Unpadding new block, content 1798 padding 241 command 0
2026/05/06 21:42:06.129029 [Debug] [1591193451] proxy: XtlsFilterTls found tls client hello! 1103

But now I think there's some incorrect configuration on the server.
Please take a look.

Now the client is sending packets to the server, but the server isn't attempting to establish a connection.
And there are no connection log entries for "id": "test-x-id."
Now the server is ignoring the client.

Master-bit715 · 2026-05-06T09:16:58Z

Master-bit715
May 6, 2026
Author

Inbound Server Configuration

############################ ipV4 ################################################################

"inbounds": [
    {
        "listen": "2.26.***.73",
        "port": 443,
        "tag": "vless-r_in",
        "protocol": "vless",
        "settings": {
            "clients": [
  

                {
                    "id": "test-x-id", // run `xray uuid` to generate
                    "path": "/download/updates",
                    "mode": "auto",
                    "flow": "",
                    "email": "test-x-id@xray.com"

                }



            ],
            "decryption": "none"
        },





        "streamSettings": {
            "network": "xhttp",



            "xhttpSettings": {
            "path": "/download/updates",
            "mode": "auto",

                "extra": {
                    "headers": {
                    // "key": "value"
                    },

                "xPaddingBytes": "100-1000",

                 "xmux": {
                    "maxConcurrency": 128,
                    "hMaxRequestTimes": 1000,
                    "hMaxReusableSecs": 3600
                }

                }

            },





            "security": "reality",

            "realitySettings": {
                "target": "www.microsoft.com:443", // A website that support TLS1.3 and h2. You can also use `1.1.1.1:443` as dest
                "serverNames": [   "www.microsoft.com"  ],   // A server name in the cert of dest site. If you use `1.1.1.1:443` as dest, then you can leave `serverNames` empty, it is a possible ways to bypass Iran's internet speed restrictions.

                "privateKey": "qAfldclt5z_*******",    // run `xray x25519` to generate. Public and private keys need to be corresponding.

                "shortIds":  [ "", "0123456789abcdef"]

            }

        },





        "sniffing": {
            "enabled": true,
            "destOverride": [ "http", "tls", "quic", "fakedns", "fakedns+others" ],
            "metadataOnly": false,
            "routeOnly": false
        }



    },

######################### ipV6 ###################################################################

    {
        "listen": "2a14:1b84:****::b79",
        "port": 443,
        "tag": "vless6-r_in",
        "protocol": "vless",
        "settings": {
            "clients": [


                {
                    "id": "test-x1-id", // run `xray uuid` to generate
                    "path": "/download/updates",
                    "mode": "auto",
                    "flow": "",
                    "email": "test-x1-id@xray.com"

                }



            ],
            "decryption": "none"
        },





        "streamSettings": {
            "network": "xhttp",



            "xhttpSettings": {
            "path": "/download/updates",
            "mode": "auto",

                "extra": {
                    "headers": {
                    // "key": "value"
                    },

                "xPaddingBytes": "100-1000",

                 "xmux": {
                    "maxConcurrency": 128,
                    "hMaxRequestTimes": 1000,
                    "hMaxReusableSecs": 3600
                }

                }

            },





            "security": "reality",

            "realitySettings": {
                "target": "speed.cloudflare.com:443", // A website that support TLS1.3 and h2. You can also use `1.1.1.1:443` as dest
                "serverNames": [   "speed.cloudflare.com"  ],   // A server name in the cert of dest site. If you use `1.1.1.1:443` as dest, then you can leave `serverNames` empty, it is a possible ways to bypass Iran's internet speed restrictions.

                "privateKey": "qAfldclt5z_*****",    // run `xray x25519` to generate. Public and private keys need to be corresponding.

                "shortIds":  [ "", "0123456789abcdef"]

            }

        },





        "sniffing": {
            "enabled": true,
            "destOverride": [ "http", "tls", "quic", "fakedns", "fakedns+others" ],
            "metadataOnly": false,
            "routeOnly": false
        }



    }

],

1 reply

jefcolbi May 6, 2026

You should share the logs when xray is starting with the config in debug mode. We would see to which ip:port it is listening and maybe any see any warning. xray doesn't always stop due to misconfiguration.

Chen017 · 2026-05-07T11:51:12Z

Chen017
May 7, 2026

You can use my template, which implement xhttp with separation of ipv4 and ipv6 using Unix socket @xhttp_inner: #6078
For your version, you may try to do the following:
Use a single inbound listening on :: instead of two separate inbounds:

{
  "listen": "::",
  "port": 443,
  "tag": "vless-xhttp",
  "protocol": "vless",
  "settings": {
    "clients": [{ "id": "test-x-id", "flow": "", "email": "xhttp@xray.com" }],
    "decryption": "none"
  },
  "streamSettings": {
    "network": "xhttp",
    "security": "reality",
    "realitySettings": { ... },
    "xhttpSettings": {
      "path": "/download/updates",
      "mode": "auto"
    }
  }
}

0 replies

Uh oh!

xhttp upstream and downstream separation #6042

Uh oh!

Uh oh!

Master-bit715 Apr 30, 2026

Replies: 3 comments · 4 replies

Uh oh!

jefcolbi May 1, 2026

Uh oh!

Uh oh!

Master-bit715 May 6, 2026 Author

Uh oh!

jefcolbi May 6, 2026

Uh oh!

Uh oh!

Master-bit715 May 6, 2026 Author

Uh oh!

Master-bit715 May 6, 2026 Author

Uh oh!

jefcolbi May 6, 2026

Uh oh!

Chen017 May 7, 2026

Master-bit715
Apr 30, 2026

Replies: 3 comments 4 replies

jefcolbi
May 1, 2026

Master-bit715 May 6, 2026
Author

Master-bit715 May 6, 2026
Author

Master-bit715
May 6, 2026
Author

Chen017
May 7, 2026